cursedops 0.16.3 → 0.18.0

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedops",
-	"version": "0.16.3",
+	"version": "0.18.0",
 	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots — and printing a command that runs when pasted — without knowing a path, the generation's whole-tree laws run over one repo from a checkout or a worktree, macOS launchd agent install/replace/remove and the live port a job serves, the scaffolding and verdicts of a deployed smoke (origin probe, the smoke's own environment, a network that lies about DNS, a settled version), the static-serving helpers eight apps copied — the path-traversal guard among them — the API floor that keeps an unmatched /api/... from ever being answered with the app shell, the commit and dirty flag a checkout-served process reports, the Cloudflare Worker deploy toolkit four apps copied (the deploy sequence, exact-set secrets over a pipe, origin-first rollback, the curl edge fetch, the row-for-row D1 import proof, the billed-CPU tail check around a deploy's walk and smoke, and each app's worker:secrets and worker:smoke main as one function of its data), the relay a Worker fronts a Mac-bound app with (the Durable Object, the frames, the Mac's dialer and key rotation — lifted from station for roms — and the signed-in stage walk's skeleton and the relay app's whole worker:deploy), the Worker import-graph and await-port checks every Worker app's suite runs over its own source, and the public-surface ratchet three published libraries each carried a forked copy of. Mechanism only — no app knows its name from here. Bun, zero runtime dependencies (typescript is an optional peer, for public-surface only), ships source.",
 	"type": "module",
 	"scripts": {

package/src/relayStage.ts

@@ -20,6 +20,7 @@ import { lookup as dnsLookup } from "node:dns/promises";
 import { readdirSync, readFileSync, statSync } from "node:fs";
 import { join, relative } from "node:path";
 import { sha256Hex } from "cursedops/relay";
+import { awaitConverged, type ConvergenceOptions, type ConvergenceProbe } from "cursedops/smoke";
 
 /** The accounts door every stage signs in at — `apps/auth` deployed a second time. */
 export const STAGE_AUTH_URL = "https://auth-stage.cursedalchemy.com";
@@ -159,6 +160,30 @@ export const realRun: Run = (argv, options) => {
 	return { status: done.status, stdout: done.stdout ?? "", stderr: done.stderr ?? "" };
 };
 
+/**
+ * 🔴 How many rounds in a row every `/healthz` must name a just-put link digest before a walk uses it.
+ * A digest put is a new Worker version, and the edge takes it up instance by instance: the link
+ * staying up for 15 s proves only that the instance the link dialled has it. The Worker signs the
+ * Mac's identity with that digest, so a request answered by an instance still on the old one is the
+ * Mac's own 401 (and station's kept read a 503). Measured 2026-10-15 (forge task 3235): station's
+ * fast-lane walk at baf8495, the link steady for 15 s, then four writes 401 at the Mac; on the real
+ * stage the put needed 8 rounds to agree 5 in a row.
+ */
+export const LINK_KEY_ROUNDS = 5;
+
+/** The question {@link putStageLinkDigest} asks after a put: does this `/healthz` answer's `worker.linkKeyId` equal `expected`? */
+export function linkKeyProbe(health: () => Promise<Response>, expected: string): ConvergenceProbe {
+	return {
+		name: "/healthz linkKeyId",
+		check: async () => {
+			const res = await health();
+			if (!res.ok) return `status ${res.status}`;
+			const id = ((await res.json()) as { worker?: { linkKeyId?: string } }).worker?.linkKeyId ?? "";
+			return id === expected ? null : `answers ${id || "no key"}, not ${expected}`;
+		},
+	};
+}
+
 export interface DigestPut {
 	/** The app's checkout, where `wrangler.jsonc` is. */
 	cwd: string;
@@ -167,31 +192,42 @@ export interface DigestPut {
 	key: string;
 	/** `cloudflareCredential(...)`. */
 	credential: Record<string, string>;
+	/** One `/healthz` read of the stage Worker — asked until every answer names the new digest. */
+	health: () => Promise<Response>;
+	/** The fingerprint `/healthz` publishes for a digest — the app's `cursedauth/relay-door` `linkKeyId(app, digest)`. */
+	keyId: (digest: string) => Promise<string>;
 	run?: Run;
+	/** Injected for tests; `rounds` defaults to {@link LINK_KEY_ROUNDS}. */
+	convergence?: ConvergenceOptions;
 }
 
 /**
  * Put `key`'s digest on the STAGE Worker (`--env stage`, always — this module has no production
- * path). A per-run key for the walk, and again for the rotation leg. `ok: false` carries wrangler's
- * stderr. A secret put is a new version that reaches the edge in its own time: the caller waits for
- * a link that stays up ({@link linkedSteadily}), never a fixed sleep.
+ * path), then return only once every `/healthz` answer has named it {@link LINK_KEY_ROUNDS} rounds in
+ * a row — so no walk can put a digest and use it before the edge has (forge tasks 3235, 3237). A
+ * per-run key for the walk, and again for the rotation leg. `ok: false` is a refused put (wrangler's
+ * stderr) or an edge that never agreed; `detail` says which, for the walk's row.
  */
-export async function putStageLinkDigest(put: DigestPut): Promise<{ ok: boolean; stderr: string }> {
+export async function putStageLinkDigest(put: DigestPut): Promise<{ ok: boolean; stderr: string; detail: string }> {
+	const digest = await sha256Hex(put.key);
 	const done = (put.run ?? realRun)(["bunx", "wrangler", "secret", "put", put.secretName, "--env", "stage"], {
 		cwd: put.cwd,
-		input: await sha256Hex(put.key),
+		input: digest,
 		env: put.credential,
 	});
-	return { ok: done.status === 0, stderr: done.stderr };
+	if (done.status !== 0) return { ok: false, stderr: done.stderr, detail: `wrangler refused the put (exit ${done.status})` };
+	const held = await awaitConverged([linkKeyProbe(put.health, await put.keyId(digest))], { rounds: LINK_KEY_ROUNDS, ...put.convergence });
+	return { ok: held.converged, stderr: done.stderr, detail: `every answer holds it — ${held.detail}` };
 }
 
-/**
- * Sign the stage owner in through auth-stage's emailed second factor and grant `app`'s stage —
- * `apps/auth-stage/scripts/inbox.ts` `grant <app>`, whose last stdout line is the grant.
- * Never production's accounts service: nothing under test signs in there (`tools/check-prod-auth.ts`).
- */
-export function grantStageOwner(spec: { forge: string; app: string; run?: Run; stderr?: (text: string) => void }): { ok: boolean; grant: string } {
-	const done = (spec.run ?? realRun)(["bun", "run", "scripts/inbox.ts", "grant", spec.app], {
+/** Which stage account a grant signs in as — `inbox.ts`'s `StageAccount`. */
+type StageAccount = "owner" | "member";
+
+type GrantSpec = { forge: string; app: string; run?: Run; stderr?: (text: string) => void };
+
+/** `apps/auth-stage/scripts/inbox.ts` `grant <app> [--member]`, whose last stdout line is the grant. */
+function grantStage(spec: GrantSpec, account: StageAccount): { ok: boolean; grant: string } {
+	const done = (spec.run ?? realRun)(["bun", "run", "scripts/inbox.ts", "grant", spec.app, ...(account === "member" ? ["--member"] : [])], {
 		cwd: join(spec.forge, "apps", "auth-stage"),
 		timeout: 300_000,
 	});
@@ -200,6 +236,23 @@ export function grantStageOwner(spec: { forge: string; app: string; run?: Run; s
 	return { ok: done.status === 0 && grant.length > 100, grant };
 }
 
+/**
+ * Sign the stage owner in through auth-stage's emailed second factor and grant `app`'s stage.
+ * Never production's accounts service: nothing under test signs in there (`tools/check-prod-auth.ts`).
+ */
+export function grantStageOwner(spec: GrantSpec): { ok: boolean; grant: string } {
+	return grantStage(spec, "owner");
+}
+
+/**
+ * The same grant for the stage's seeded household MEMBER — an ordinary account, never the owner —
+ * so a walk can prove on the real edge what an app keeps from everyone but its owner (roms' closed
+ * consoles, forge task 3288). Same door, same rules: never production's accounts service.
+ */
+export function grantStageMember(spec: GrantSpec): { ok: boolean; grant: string } {
+	return grantStage(spec, "member");
+}
+
 export interface RotationSpec {
 	/** Stop the Mac end, resolving once it has exited. */
 	stop: () => Promise<void>;